Changes in XML Signature Syntax and Processing (Second Edition)

Frederick Hirsch <>
Thomas Roessler <>
$Date: 2008/06/09 21:09:47 $

Status of this Document

This document summarizes the changes that the XML Security Specifications Maintenance Group has made to the XML Signature Syntax and Processing Specification in preparing a proposed second edition.

Discussion of Changes

Cover page

Updated to 2nd edition, updated status of the document section, added Frederick Hirsch and Thomas Roesssler as editors.

Removed "-" from title, changing "XML-Signature" to "XML Signature".

Updated some e-mail addresses (after PER review).

Updated MIT link from lcs to csail.

1.3 Versions, Namespaces and Identifiers

Updated normative reference for SHA-1 to FIPS 180-2.

1.4 Acknwoledgements

Affiliation updates (after PER review).

2.1 Simple Examples

Example updated to use C14N 1.1; digest values removed to avoid impression that example could serve as a useful test case.

2.1.1 More on References


2.2 Extended Example

Example updated to use C14N 1.1 by way of Transforms element; digest value removed; lines in example and references to them renumbered.

2.3 Extended Example


3.1.1 Reference Generation

Added material to RECOMMEND C14N 1.1 if inclusive canonicalization is desired, and explain its use through Transforms element. The URI Attribute

Clarified specification language to match its intent; referring to XML Schema part 2, 2nd Edition for encoding rules.

Removed "MUST be able to parse URI syntax", as it is not a testable conformance requirement.

Clarified role of Type attribute per erratum E05. The Reference Processing Model

Added a pointer to Section 3.1.1 to draw attention to handling of default canonicalization algorithms.

Defined same-document reference consistent with RFC 2396 to avoid conformance-affecting side effects from change of normative reference to RFC 3986.

Rephrased xpointer-related parts of reference processing model in terms of the XPointer Framework Recommendation; the model was phrased in terms of the failed 2001 XPointer Candidate Recommendation.

Defined REQUIRED xpointer() scheme xpointers explicitly, since xpointer() scheme is not a Recommendation. (cf XML Coordination Group discussion [member confidential].)

Added clarification of change in specification text. Same-Document URI References

Rephrased specification language in terms of the XPointer Framework Recommendation. The Transforms Element

Corrected document-internal link to section 6.6.

4.4.3 The RetrievalMethod Element

Clarified role of Type attribute per erratum E05.

Added note on discrepancy between schema and DTD. While the DTD is correct (and the schema wrong), the group resolved to keep the schema intact.

4.4.4 The X509Data Element

Corrected reference for LDAP-DN to refer to reference in current document; the reference had been an absolute URI reference in the PER. This was corrected in sections 4.4.4 and The need for this change was noted during the XML Signature, Second Edition Proposed Edited Recommendation review period., Distinguished Name Encoding Rules

Updated normative reference from RFC 2253 to RFC 4514.

Clarified requirements on content of X509IssuerSerial and X509SubjectName elements.

Clarified conformance requirements in section

Clarified additional encoding rules.

This change addresses erratum E01, but goes beyond the changes proposed there.

Corrected typo noted during Proposed Edited Recommendation review.

4.5 The Object Element

Correction of example per E06.

6.1 Algorithm Identifiers and Implementation Requirements

Added Canonical XML 1.1 as Required, Canonical XML 1.1 with Comments as Recommended.

6.2.1 SHA-1

Update SHA-1 link to point to FIPS-180-2.

6.4.2 PKCS1 (RSA-SHA1)

Editorial change per E07.

6.5 Canonicalization Algorithms

Editorial changes.

Added discussion of C14N 1.1 vs C14N 1.0.

Clarification of normal form output from canonicalization algorithms per E04.

Added note per E02 to point out existence of exclusive canonicalization, with editorial changes to cover C14N 1.1.

6.5.1 Canonical XML 1.0

Renamed from "Canonical XML" to "Canonical XML 1.0"; corresponding change in body of section.

6.5.2 Canonical XML 1.1

New section.

6.6.2 Base64

Change "barename" to "shortname" to use terminology from XPointer Framework Recommendation.

6.6.3 XPath

Change "barename" to "shortname" to use terminology from XPointer Framework Recommendation.

Add pointer to XPath Filter 2.0 Recommendation per E03.

11 References

Updates to implement changes outlined above.

Updated normative reference for SHA-1 to point to FIPS PUB 180-2 instead of FIPS PUB 180-1.

Updated normative reference for DSA to point to current version of FIPS PUB 186-2.

Removed the reference to the Unicode home page, since it is no longer referenced within the document. This should remove the possibility of any misinterpretation of the reference and not raise any false implications. The rationale is that the reference is not normative, not referred to in the document, and not very precise as it refers to a web page and may be misinterpreted. The Working Group felt that the best approach is to allow the XML specification to refer to Unicode appropriately.

The reference to XSL referenced XSL 1.0 even though the latest version is XSL 1.1. It was also removed since it is informative, not referenced and could be misleading.

These changes were made during Proposed Edited Recommendation review period of the XML Signature, Second Edition specification in response to comments regarding the references; see 6 May 2008 meeting minutes.

Udated the reference for Canonicalization 1.1 to reference the Recommendation, as it achieved this status during the Proposed Edited Recommendation review period of the XML Signature, Second Edition specification.

Updated the reference for XML 1.1 to the Fourth Edition and the reference for Namespaces in XML 1.0 to the Second Edition. This change was made during Proposed Edited Recommendation review period of the XML Signature, Second Edition specification in response to comments regarding the references. The Working Group noted that this change makes these references consistent with Canonicalization 1.1 as well as RFC changes made in the XML Signature, Second Edition. The Working Group also noted that according to process document, if there is an errata for a normative spec, then this would not impact conformance for that version of the specification with the errata, but that the errata must be included in the next version and hence would impact conformance on that next version. Thus the errata introduced in XML 1.0 Fourth Edition should not impact conformance related to XML Signature, Second Edition. (See 6 May 2008 meeting minutes.)

Updated the link in the SAX reference to reflect updated URL.

12 Authors' Address

Updated Donald Eastlake and Joseph Reagle contact information.